This issue has been resolved. Long story short, we had to use a workaround. We created a file watcher that imported the data, however, we kept the input script that moved the file after 5 minutes to a new directory so the same data wasn't imported more than once. The xml data from the script kept being received out of order by Splunk and that is what was causing the parsing issue. Saving the data from the script to file was in order, though. Doesn't make sense why it kept doing this, but you fix it and move on.
... View more